All Apps and Add-ons

Why am I getting an error: "only one item is allowed in root directory" while uploading the app on Splunk Apps?

pjvarjani
Path Finder

I am trying to upload an app on splunk apps (tried both .spl and .tar.gz extensions).. But it throws error "only one item is allowed in root directory".

When I extract same tarball package on local system it gets extracted with a single root folder "xyz" (xyz is the name of app), which contains other directories like bin, default, metadata etc...

Below are the contents of app.conf:

[package]

id = xyz

[install]

is_configured = 0

[ui]

is_visible = 1
label = abc

[launcher]

author =
description = Splunk app for xyz

version = 1.0

0 Karma
1 Solution

wnguyen
Splunk Employee
Splunk Employee

Responding to an old question to hopefully help those that still run into the same issue:

When packaging your tarball, do not package specifying a relative path, as the tarball will compress with the relative path included. That is to say,

do not do this:
tar -cv --exclude='*DS_Store' ./multi_root > multi_root.tar

but instead this:
tar -cv --exclude='*DS_Store' not_multi_root > not_multi_root.tar

View solution in original post

wnguyen
Splunk Employee
Splunk Employee

Responding to an old question to hopefully help those that still run into the same issue:

When packaging your tarball, do not package specifying a relative path, as the tarball will compress with the relative path included. That is to say,

do not do this:
tar -cv --exclude='*DS_Store' ./multi_root > multi_root.tar

but instead this:
tar -cv --exclude='*DS_Store' not_multi_root > not_multi_root.tar

MuS
Legend

Hi pjvarjani,

follow the docs about app packaging http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/PackageApp , looks like there is still an error in the tar ball, like appdir\appdir\...
Also, check this docs http://docs.splunk.com/Documentation/Splunkbase/latest/Splunkbase/Namingguidelines about your App name, there are some restrictions.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...